https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T04:37:53.275472+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-338571 EUVD-2026-338571 2026-10-15T04:37:53.320163+00:00 EUVD-2026-338571 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45325 fkie_cve-2026-45325 2026-10-15T04:37:53.320201+00:00

Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in setValueAtPath() in packages/utils/src/generic/value-at-path.ts because unsafe path segments are not blocked. This issue is fixed in version 20260509.0340.15.

 https://cve.radiocsirt.org/vuln/ghsa-cmxg-94mg-jq94 GHSA-cmxg-94mg-jq94 — @tmlmobilidade/utils has prototype pollution in its setValueAtPath 2026-10-15T04:37:53.320233+00:00

Affected: npm: @tmlmobilidade/utils

### Impact Prototype pollution vulnerability in @tmlmobilidade/utils for setValueAtPath().

### Patches A fix is available in versions 20260509.0340.15 and up.